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LISTING OF CLAIMS 
This listing of claims will replace all prior versions, and listings, of claims of the 
application: 

Claim 1 (Currently Amended) A method for restoring a computer system modified by 
malicious code, comprising: 

scanning the computer system for the malicious code; 
identifying the malicious code; 

retrieving from a data file, information relating to the malicious code including at least 
one command used for restoring the computer system to a state that existed prior to modification 
by the malicious code; and 

executing the at least one command to restore the computer system to Gubotantially the 
state as it existed prior to modification by the malicious code. 

Claim 2 (Original) The method of claim 1, wherein the step of executing the at least one 
command includes one of reading, writing, and deleting data. 

Claim 3 (Original) The method of claim 1, wherein the step of executing the at least one 
command includes at least one of renaming and deleting a file. 

Claim 4 (Original) The method of claim 1, wherein the malicious code modifies at least 
one file and said method comprises: 

reading from the modified file, a name of a second file; and 
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modifying the second file. 

Claim 5 (Original) The method of claim 1, wherein the data file comprises a plurality of 
data files, each data file being provided for a particular type of malicious code, each data file 
including at least one command that can be used for restoring the computer system to a state that 
existed prior to modification by the particular type of malicious code. 

Claim 6 (Currently Amended) A storage medium including computer executable code 
for restoring a computer system modified by malicious code, comprising: 
code for scanning the computer system for the malicious code; 
code for identifying the malicious code; 

code for retrieving from a data file, information relating to the malicious code including 
at least one command used for restoring the computer system to a state that existed prior to 
modification by the malicious code; and 

code for executing the at least one command to restore the computer system to 
Gubstantially the state as it existed prior to modification by the malicious code. 

Claim 7 (Currently Amended) The storage medium of claim 6, wherein the code for 
executing the at least one command includes code for performing at least one ewe of reading, 
writing, and deleting data. 

Claim 8 (Original) The storage medium of claim 6, wherein the code for executing the at 
least. one command includes code for performing at least one of renaming and deleting a file. 
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Claim 9 (Original) The storage medium of claim 6, wherein the malicious code modifies 
at least one file, said storage medium fiirther comprising: 

code for reading fi-om the modified file, a name of a second file; and 
code for modifying the second file. 

Claim 10 (Original) The storage medium of claim 6, wherein the data file comprises a 
plurality of data files, each data file being provided for a particular type of malicious code, each 
data file including at least one command that can be used for restoring the computer system to a 
state that existed prior to modification by the particular type of malicious code. 

Claim 1 1 (Currently Amended) A computer data signal embodied in a transmission 
medium and including computer executable instructions for restoring a computer system 
modified by malicious code, comprising: 

a data signal portion for scanning the computer system for the malicious code; 

a data signal portion for identifying the malicious code; 

a data signal portion for retrieving from a data file, information relating to the malicious 

r 

code including at least one command used for restoring the computer system to a state that 
existed prior to modification by the malicious code; and 

a data signal portion for executing the at least one command to restore the computer 
system to gubotantially the state as it existed prior to modification by the malicious code. 

Claim 12 (Original) The computer data signal of claim 11, wherein the data signal 
portion for executing the at least one command performs at least one of reading, writing, and 
deleting data. 
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Claim 13 (Original) The computer data signal of claim 11, wherein the data signal 
portion for executing the at least one command performs at least one of renaming and deleting a 
file. 

Claim 14 (Original) The computer data signal of claim 11, wherein the malicious code 
modifies at least one file, said computer data signal further comprising: 

a data signal portion for reading fi-om the modified file, a name of a second file; and 
a data signal portion for modifying the second file. 

Claim 15 (Original) The computer data signal of claim 11, wherein the data file 
comprises a plurality of data files, each data file being provided for a particular type of malicious 
code, each data file including at least one command that can be used for restoring the computer 
system to a state that existed prior to modification by the particular type of malicious code. 

Claim 16 (Currently Amended) A programmed computer system including a program 
for restoring a computer system modified by malicious code, comprising: 
means for scanning the computer system for the malicious code; 
means for identifying the malicious code; 

means for retrieving from a data file, information relating to the malicious code including 
at least one command used for restoring the computer system to a state that existed prior to 
modification by the malicious code; and 

means for executing the at least one command to restore the computer system to 
Gubotantially the state as it existed prior to modification by the malicious code. 
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Claim 1 7 (Original) The programmed computer system of claim 1 6, wherein the means 
for executing the at least one command includes means for performing at least one of reading, 
writing, and deleting data. 

Claim 1 8 (Original) The programmed computer system of claim 1 6, wherein the means 
for executing the at least one command includes means for performing at least one of renaming 
and deleting a file. 

Claim 19 (Original) The programmed computer system of claim 16, wherein the 
malicious code modifies at least one file and said system further comprises: 
means for reading firom the modified file, a name of a second file; and 
means for modifying the second file. 

Claim 20 (Original) The programmed computer system of claim 16, wherein the data file 
comprises a plurality of data files, each data file being provided for a particular type of malicious 
code, each data file including at least one command that can be used for restoring the computer 
system to a state that existed prior to modification by the particular type of malicious code. 

Please add claims 21-24 as follows. 

Claim 21 (New) The method of claim 1, wherein the information relating to the 
malicious code fiirther comprises at least one command for curing a file infected with the 
malicious code. 
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Claim 22 (New) The storage medium of claim 6, wherein the information relating to the 
malicious code further comprises at least one command for curing a file infected with the 
malicious code. 

Claim 23 (New) A computer data signal of claim 11, wherein the information relating to 
the malicious code further comprises at least one command for curing a file infected with the 
malicious code. 

Claim 24 (New) A programmed computer system of claim 16, wherein the information 
relating to the malicious code further comprises at least one command for curing a file infected 
with the malicious code. 



